Thclaws
Monthly
Symlink-following file writes in thClaws through 0.141.0 let an attacker who can pre-plant a symbolic link under the permitted inputs/ prefix redirect a later authenticated upload to the v1 API POST /v1/inputs endpoint, causing the post_inputs handler to write or truncate files outside the workspace with daemon privileges. Exploitation requires two preconditions in sequence - the staged symlink plus a real authenticated upload targeting that path - so a single remote request cannot trigger it, and the resulting impact is confined to file integrity and availability with no confidentiality disclosure. All available signals rate this as a low-priority issue and are mutually consistent: the vendor records CVSS 2.3, our independent assessment is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L, and no public exploit code was identified at time of analysis.
Symlink-following file writes in thClaws through 0.141.0 let an attacker who can pre-plant a symbolic link under the permitted inputs/ prefix redirect a later authenticated upload to the v1 API POST /v1/inputs endpoint, causing the post_inputs handler to write or truncate files outside the workspace with daemon privileges. Exploitation requires two preconditions in sequence - the staged symlink plus a real authenticated upload targeting that path - so a single remote request cannot trigger it, and the resulting impact is confined to file integrity and availability with no confidentiality disclosure. All available signals rate this as a low-priority issue and are mutually consistent: the vendor records CVSS 2.3, our independent assessment is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L, and no public exploit code was identified at time of analysis.